CVE-2025-22035 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a
https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f
https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb
https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906
https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b
https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e
https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a
https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813
https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70
https://lore.kernel.org/linux-cve-announce/2025041658-CVE-2025-22035-b50c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-22035
https://www.cve.org/CVERecord?id=CVE-2025-22035

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025041658-CVE-2025-22035-b50c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-22035 https://www.cve.org/CVERecord?id=CVE-2025-22035
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/
Title		tracing: Fix use-after-free in print_graph_function_flags during tracer switching
References		https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22035", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.809Z", "datePublished": "2025-04-16T14:11:53.958Z", "dateUpdated": "2025-05-26T05:17:03.661Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-26T05:17:03.661Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free in print_graph_function_flags during tracer switching\n\nKairui reported a UAF issue in print_graph_function_flags() during\nftrace stress testing [1]. This issue can be reproduced if puting a\n'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(),\nand executing the following script:\n\n  $ echo function_graph > current_tracer\n  $ cat trace > /dev/null &\n  $ sleep 5  # Ensure the 'cat' reaches the 'mdelay(10)' point\n  $ echo timerlat > current_tracer\n\nThe root cause lies in the two calls to print_graph_function_flags\nwithin print_trace_line during each s_show():\n\n  * One through 'iter->trace->print_line()';\n  * Another through 'event->funcs->trace()', which is hidden in\n    print_trace_fmt() before print_trace_line returns.\n\nTracer switching only updates the former, while the latter continues\nto use the print_line function of the old tracer, which in the script\nabove is print_graph_function_flags.\n\nMoreover, when switching from the 'function_graph' tracer to the\n'timerlat' tracer, s_start only calls graph_trace_close of the\n'function_graph' tracer to free 'iter->private', but does not set\nit to NULL. This provides an opportunity for 'event->funcs->trace()'\nto use an invalid 'iter->private'.\n\nTo fix this issue, set 'iter->private' to NULL immediately after\nfreeing it in graph_trace_close(), ensuring that an invalid pointer\nis not passed to other tracers. Additionally, clean up the unnecessary\n'iter->private = NULL' during each 'cat trace' when using wakeup and\nirqsoff tracers.\n\n [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_functions_graph.c", "kernel/trace/trace_irqsoff.c", "kernel/trace/trace_sched_wakeup.c"], "versions": [{"version": "05319d707732c728eb721ac616a50e7978eb499a", "lessThan": "42561fe62c3628ea3bc9623f64f047605e98857f", "status": "affected", "versionType": "git"}, {"version": "b8205dfed68183dc1470e83863c5ded6d7fa30a9", "lessThan": "de7b309139f862a44379ecd96e93c9133c69f813", "status": "affected", "versionType": "git"}, {"version": "ce6e2b14bc094866d9173db6935da2d752f06d8b", "lessThan": "81a85b12132c8ffe98f5ddbdc185481790aeaa1b", "status": "affected", "versionType": "git"}, {"version": "2cb0c037c927db4ec928cc927488e52aa359786e", "lessThan": "a2cce54c1748216535dda02e185d07a084be837e", "status": "affected", "versionType": "git"}, {"version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "099ef3385800828b74933a96c117574637c3fb3a", "status": "affected", "versionType": "git"}, {"version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "c85efe6e13743cac6ba4ccf144cb91f44c86231a", "status": "affected", "versionType": "git"}, {"version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "f14752d66056d0c7bffe5092130409417d3baa70", "status": "affected", "versionType": "git"}, {"version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "70be951bc01e4a0e10d443f3510bb17426f257fb", "status": "affected", "versionType": "git"}, {"version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "7f81f27b1093e4895e87b74143c59c055c3b1906", "status": "affected", "versionType": "git"}, {"version": "d6b35c9a8d51032ed9890431da3ae39fe76c1ae3", "status": "affected", "versionType": "git"}, {"version": "5d433eda76b66ab271f5924b26ddfec063eeb454", "status": "affected", "versionType": "git"}, {"version": "2242640e9bd94e706acf75c60a2ab1d0e150e0fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_functions_graph.c", "kernel/trace/trace_irqsoff.c", "kernel/trace/trace_sched_wakeup.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.292", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.134", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.87", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.23", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.11", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.255", "versionEndExcluding": "5.4.292"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.193", "versionEndExcluding": "5.10.236"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.129", "versionEndExcluding": "5.15.180"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.50", "versionEndExcluding": "6.1.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.87"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.13.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.14.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.324"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.293"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f"}, {"url": "https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813"}, {"url": "https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b"}, {"url": "https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e"}, {"url": "https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a"}, {"url": "https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a"}, {"url": "https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70"}, {"url": "https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb"}, {"url": "https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906"}], "title": "tracing: Fix use-after-free in print_graph_function_flags during tracer switching", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-22035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-21T14:57:52.767300Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-21T15:01:46.658Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-22035 (string)

assignerOrgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

state : PUBLISHED (string)

assignerShortName : Linux (string)

dateReserved : 2024-12-29T08:45:45.809Z (string)

datePublished : 2025-04-16T14:11:53.958Z (string)

dateUpdated : 2025-05-26T05:17:03.661Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

shortName : Linux (string)

dateUpdated : 2025-05-26T05:17:03.661Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ (string)

}

]

affected : [ »

0 : { »

product : Linux (string)

vendor : Linux (string)

defaultStatus : unaffected (string)

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

programFiles : [ »

0 : kernel/trace/trace_functions_graph.c (string)

1 : kernel/trace/trace_irqsoff.c (string)

2 : kernel/trace/trace_sched_wakeup.c (string)

]

versions : [ »

0 : { »

version : 05319d707732c728eb721ac616a50e7978eb499a (string)

lessThan : 42561fe62c3628ea3bc9623f64f047605e98857f (string)

status : affected (string)

versionType : git (string)

}

1 : { »

version : b8205dfed68183dc1470e83863c5ded6d7fa30a9 (string)

lessThan : de7b309139f862a44379ecd96e93c9133c69f813 (string)

status : affected (string)

versionType : git (string)

}

2 : { »

version : ce6e2b14bc094866d9173db6935da2d752f06d8b (string)

lessThan : 81a85b12132c8ffe98f5ddbdc185481790aeaa1b (string)

status : affected (string)

versionType : git (string)

}

3 : { »

version : 2cb0c037c927db4ec928cc927488e52aa359786e (string)

lessThan : a2cce54c1748216535dda02e185d07a084be837e (string)

status : affected (string)

versionType : git (string)

}

4 : { »

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 099ef3385800828b74933a96c117574637c3fb3a (string)

status : affected (string)

versionType : git (string)

}

5 : { »

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : c85efe6e13743cac6ba4ccf144cb91f44c86231a (string)

status : affected (string)

versionType : git (string)

}

6 : { »

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : f14752d66056d0c7bffe5092130409417d3baa70 (string)

status : affected (string)

versionType : git (string)

}

7 : { »

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 70be951bc01e4a0e10d443f3510bb17426f257fb (string)

status : affected (string)

versionType : git (string)

}

8 : { »

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 7f81f27b1093e4895e87b74143c59c055c3b1906 (string)

status : affected (string)

versionType : git (string)

}

9 : { »

version : d6b35c9a8d51032ed9890431da3ae39fe76c1ae3 (string)

status : affected (string)

versionType : git (string)

}

10 : { »

version : 5d433eda76b66ab271f5924b26ddfec063eeb454 (string)

status : affected (string)

versionType : git (string)

}

11 : { »

version : 2242640e9bd94e706acf75c60a2ab1d0e150e0fb (string)

status : affected (string)

versionType : git (string)

}

]

}

1 : { »

product : Linux (string)

vendor : Linux (string)

defaultStatus : affected (string)

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

programFiles : [ »

0 : kernel/trace/trace_functions_graph.c (string)

1 : kernel/trace/trace_irqsoff.c (string)

2 : kernel/trace/trace_sched_wakeup.c (string)

]

versions : [ »

0 : { »

version : 6.5 (string)

status : affected (string)

}

1 : { »

version : 0 (string)

lessThan : 6.5 (string)

status : unaffected (string)

versionType : semver (string)

}

2 : { »

version : 5.4.292 (string)

lessThanOrEqual : 5.4.* (string)

status : unaffected (string)

versionType : semver (string)

}

3 : { »

version : 5.10.236 (string)

lessThanOrEqual : 5.10.* (string)

status : unaffected (string)

versionType : semver (string)

}

4 : { »

version : 5.15.180 (string)

lessThanOrEqual : 5.15.* (string)

status : unaffected (string)

versionType : semver (string)

}

5 : { »

version : 6.1.134 (string)

lessThanOrEqual : 6.1.* (string)

status : unaffected (string)

versionType : semver (string)

}

6 : { »

version : 6.6.87 (string)

lessThanOrEqual : 6.6.* (string)

status : unaffected (string)

versionType : semver (string)

}

7 : { »

version : 6.12.23 (string)

lessThanOrEqual : 6.12.* (string)

status : unaffected (string)

versionType : semver (string)

}

8 : { »

version : 6.13.11 (string)

lessThanOrEqual : 6.13.* (string)

status : unaffected (string)

versionType : semver (string)

}

9 : { »

version : 6.14.2 (string)

lessThanOrEqual : 6.14.* (string)

status : unaffected (string)

versionType : semver (string)

}

10 : { »

version : 6.15 (string)

lessThanOrEqual : * (string)

status : unaffected (string)

versionType : original_commit_for_fix (string)

}

]

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 5.4.255 (string)

versionEndExcluding : 5.4.292 (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 5.10.193 (string)

versionEndExcluding : 5.10.236 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 5.15.129 (string)

versionEndExcluding : 5.15.180 (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.1.50 (string)

versionEndExcluding : 6.1.134 (string)

}

4 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.5 (string)

versionEndExcluding : 6.6.87 (string)

}

5 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.5 (string)

versionEndExcluding : 6.12.23 (string)

}

6 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.5 (string)

versionEndExcluding : 6.13.11 (string)

}

7 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.5 (string)

versionEndExcluding : 6.14.2 (string)

}

8 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.5 (string)

versionEndExcluding : 6.15 (string)

}

9 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 4.14.324 (string)

}

10 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 4.19.293 (string)

}

11 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 6.4.13 (string)

}

]

}

]

}

]

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f (string)

}

1 : { »

url : https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 (string)

}

2 : { »

url : https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b (string)

}

3 : { »

url : https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e (string)

}

4 : { »

url : https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a (string)

}

5 : { »

url : https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a (string)

}

6 : { »

url : https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 (string)

}

7 : { »

url : https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb (string)

}

8 : { »

url : https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 (string)

}

]

title : tracing: Fix use-after-free in print_graph_function_flags during tracer switching (string)

x_generator : { »

engine : bippy-1.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-22035 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-21T14:57:52.767300Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-416 (string)

description : CWE-416 Use After Free (string)

}

]

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-21T15:01:46.658Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-22035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-21T14:57:52.767300Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-21T14:57:27.164Z"}}], "cna": {"title": "tracing: Fix use-after-free in print_graph_function_flags during tracer switching", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "05319d707732c728eb721ac616a50e7978eb499a", "lessThan": "42561fe62c3628ea3bc9623f64f047605e98857f", "versionType": "git"}, {"status": "affected", "version": "b8205dfed68183dc1470e83863c5ded6d7fa30a9", "lessThan": "de7b309139f862a44379ecd96e93c9133c69f813", "versionType": "git"}, {"status": "affected", "version": "ce6e2b14bc094866d9173db6935da2d752f06d8b", "lessThan": "81a85b12132c8ffe98f5ddbdc185481790aeaa1b", "versionType": "git"}, {"status": "affected", "version": "2cb0c037c927db4ec928cc927488e52aa359786e", "lessThan": "a2cce54c1748216535dda02e185d07a084be837e", "versionType": "git"}, {"status": "affected", "version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "099ef3385800828b74933a96c117574637c3fb3a", "versionType": "git"}, {"status": "affected", "version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "c85efe6e13743cac6ba4ccf144cb91f44c86231a", "versionType": "git"}, {"status": "affected", "version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "f14752d66056d0c7bffe5092130409417d3baa70", "versionType": "git"}, {"status": "affected", "version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "70be951bc01e4a0e10d443f3510bb17426f257fb", "versionType": "git"}, {"status": "affected", "version": "eecb91b9f98d6427d4af5fdb8f108f52572a39e7", "lessThan": "7f81f27b1093e4895e87b74143c59c055c3b1906", "versionType": "git"}, {"status": "affected", "version": "d6b35c9a8d51032ed9890431da3ae39fe76c1ae3", "versionType": "git"}, {"status": "affected", "version": "5d433eda76b66ab271f5924b26ddfec063eeb454", "versionType": "git"}, {"status": "affected", "version": "2242640e9bd94e706acf75c60a2ab1d0e150e0fb", "versionType": "git"}], "programFiles": ["kernel/trace/trace_functions_graph.c", "kernel/trace/trace_irqsoff.c", "kernel/trace/trace_sched_wakeup.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.292", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.236", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.180", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.134", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.87", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.23", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.11", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14.2", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/trace/trace_functions_graph.c", "kernel/trace/trace_irqsoff.c", "kernel/trace/trace_sched_wakeup.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f"}, {"url": "https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813"}, {"url": "https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b"}, {"url": "https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e"}, {"url": "https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a"}, {"url": "https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a"}, {"url": "https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70"}, {"url": "https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb"}, {"url": "https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free in print_graph_function_flags during tracer switching\n\nKairui reported a UAF issue in print_graph_function_flags() during\nftrace stress testing [1]. This issue can be reproduced if puting a\n'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(),\nand executing the following script:\n\n  $ echo function_graph > current_tracer\n  $ cat trace > /dev/null &\n  $ sleep 5  # Ensure the 'cat' reaches the 'mdelay(10)' point\n  $ echo timerlat > current_tracer\n\nThe root cause lies in the two calls to print_graph_function_flags\nwithin print_trace_line during each s_show():\n\n  * One through 'iter->trace->print_line()';\n  * Another through 'event->funcs->trace()', which is hidden in\n    print_trace_fmt() before print_trace_line returns.\n\nTracer switching only updates the former, while the latter continues\nto use the print_line function of the old tracer, which in the script\nabove is print_graph_function_flags.\n\nMoreover, when switching from the 'function_graph' tracer to the\n'timerlat' tracer, s_start only calls graph_trace_close of the\n'function_graph' tracer to free 'iter->private', but does not set\nit to NULL. This provides an opportunity for 'event->funcs->trace()'\nto use an invalid 'iter->private'.\n\nTo fix this issue, set 'iter->private' to NULL immediately after\nfreeing it in graph_trace_close(), ensuring that an invalid pointer\nis not passed to other tracers. Additionally, clean up the unnecessary\n'iter->private = NULL' during each 'cat trace' when using wakeup and\nirqsoff tracers.\n\n [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.292", "versionStartIncluding": "5.4.255"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.236", "versionStartIncluding": "5.10.193"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.180", "versionStartIncluding": "5.15.129"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.134", "versionStartIncluding": "6.1.50"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.87", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.23", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.11", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.324"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.293"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.4.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-26T05:17:03.661Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22035", "state": "PUBLISHED", "dateUpdated": "2025-05-26T05:17:03.661Z", "dateReserved": "2024-12-29T08:45:45.809Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-16T14:11:53.958Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-22035 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-21T14:57:52.767300Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-416 (string)

description : CWE-416 Use After Free (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-21T14:57:27.164Z (string)

}

]

cna : { »

title : tracing: Fix use-after-free in print_graph_function_flags during tracer switching (string)

affected : [ »

0 : { »

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

vendor : Linux (string)

product : Linux (string)

versions : [ »

0 : { »

status : affected (string)

version : 05319d707732c728eb721ac616a50e7978eb499a (string)

lessThan : 42561fe62c3628ea3bc9623f64f047605e98857f (string)

versionType : git (string)

}

1 : { »

status : affected (string)

version : b8205dfed68183dc1470e83863c5ded6d7fa30a9 (string)

lessThan : de7b309139f862a44379ecd96e93c9133c69f813 (string)

versionType : git (string)

}

2 : { »

status : affected (string)

version : ce6e2b14bc094866d9173db6935da2d752f06d8b (string)

lessThan : 81a85b12132c8ffe98f5ddbdc185481790aeaa1b (string)

versionType : git (string)

}

3 : { »

status : affected (string)

version : 2cb0c037c927db4ec928cc927488e52aa359786e (string)

lessThan : a2cce54c1748216535dda02e185d07a084be837e (string)

versionType : git (string)

}

4 : { »

status : affected (string)

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 099ef3385800828b74933a96c117574637c3fb3a (string)

versionType : git (string)

}

5 : { »

status : affected (string)

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : c85efe6e13743cac6ba4ccf144cb91f44c86231a (string)

versionType : git (string)

}

6 : { »

status : affected (string)

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : f14752d66056d0c7bffe5092130409417d3baa70 (string)

versionType : git (string)

}

7 : { »

status : affected (string)

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 70be951bc01e4a0e10d443f3510bb17426f257fb (string)

versionType : git (string)

}

8 : { »

status : affected (string)

version : eecb91b9f98d6427d4af5fdb8f108f52572a39e7 (string)

lessThan : 7f81f27b1093e4895e87b74143c59c055c3b1906 (string)

versionType : git (string)

}

9 : { »

status : affected (string)

version : d6b35c9a8d51032ed9890431da3ae39fe76c1ae3 (string)

versionType : git (string)

}

10 : { »

status : affected (string)

version : 5d433eda76b66ab271f5924b26ddfec063eeb454 (string)

versionType : git (string)

}

11 : { »

status : affected (string)

version : 2242640e9bd94e706acf75c60a2ab1d0e150e0fb (string)

versionType : git (string)

}

]

programFiles : [ »

0 : kernel/trace/trace_functions_graph.c (string)

1 : kernel/trace/trace_irqsoff.c (string)

2 : kernel/trace/trace_sched_wakeup.c (string)

]

defaultStatus : unaffected (string)

}

1 : { »

repo : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (string)

vendor : Linux (string)

product : Linux (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.5 (string)

}

1 : { »

status : unaffected (string)

version : 0 (string)

lessThan : 6.5 (string)

versionType : semver (string)

}

2 : { »

status : unaffected (string)

version : 5.4.292 (string)

versionType : semver (string)

lessThanOrEqual : 5.4.* (string)

}

3 : { »

status : unaffected (string)

version : 5.10.236 (string)

versionType : semver (string)

lessThanOrEqual : 5.10.* (string)

}

4 : { »

status : unaffected (string)

version : 5.15.180 (string)

versionType : semver (string)

lessThanOrEqual : 5.15.* (string)

}

5 : { »

status : unaffected (string)

version : 6.1.134 (string)

versionType : semver (string)

lessThanOrEqual : 6.1.* (string)

}

6 : { »

status : unaffected (string)

version : 6.6.87 (string)

versionType : semver (string)

lessThanOrEqual : 6.6.* (string)

}

7 : { »

status : unaffected (string)

version : 6.12.23 (string)

versionType : semver (string)

lessThanOrEqual : 6.12.* (string)

}

8 : { »

status : unaffected (string)

version : 6.13.11 (string)

versionType : semver (string)

lessThanOrEqual : 6.13.* (string)

}

9 : { »

status : unaffected (string)

version : 6.14.2 (string)

versionType : semver (string)

lessThanOrEqual : 6.14.* (string)

}

10 : { »

status : unaffected (string)

version : 6.15 (string)

versionType : original_commit_for_fix (string)

lessThanOrEqual : * (string)

}

]

programFiles : [ »

0 : kernel/trace/trace_functions_graph.c (string)

1 : kernel/trace/trace_irqsoff.c (string)

2 : kernel/trace/trace_sched_wakeup.c (string)

]

defaultStatus : affected (string)

}

]

references : [ »

0 : { »

url : https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f (string)

}

1 : { »

url : https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 (string)

}

2 : { »

url : https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b (string)

}

3 : { »

url : https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e (string)

}

4 : { »

url : https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a (string)

}

5 : { »

url : https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a (string)

}

6 : { »

url : https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 (string)

}

7 : { »

url : https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb (string)

}

8 : { »

url : https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 (string)

}

]

x_generator : { »

engine : bippy-1.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ (string)

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

negate : false (boolean)

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.4.292 (string)

versionStartIncluding : 5.4.255 (string)

}

1 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.10.236 (string)

versionStartIncluding : 5.10.193 (string)

}

2 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 5.15.180 (string)

versionStartIncluding : 5.15.129 (string)

}

3 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.1.134 (string)

versionStartIncluding : 6.1.50 (string)

}

4 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.6.87 (string)

versionStartIncluding : 6.5 (string)

}

5 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.12.23 (string)

versionStartIncluding : 6.5 (string)

}

6 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.13.11 (string)

versionStartIncluding : 6.5 (string)

}

7 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.14.2 (string)

versionStartIncluding : 6.5 (string)

}

8 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.15 (string)

versionStartIncluding : 6.5 (string)

}

9 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionStartIncluding : 4.14.324 (string)

}

10 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionStartIncluding : 4.19.293 (string)

}

11 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionStartIncluding : 6.4.13 (string)

}

]

operator : OR (string)

}

]

}

]

providerMetadata : { »

orgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

shortName : Linux (string)

dateUpdated : 2025-05-26T05:17:03.661Z (string)

}

cveMetadata : { »

cveId : CVE-2025-22035 (string)

state : PUBLISHED (string)

dateUpdated : 2025-05-26T05:17:03.661Z (string)

dateReserved : 2024-12-29T08:45:45.809Z (string)

assignerOrgId : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

datePublished : 2025-04-16T14:11:53.958Z (string)

assignerShortName : Linux (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "71EE7896-7ADF-4518-840E-AFA5008A220C", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.324", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D51950EF-B814-4998-A0B2-65B014DDF4B1", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.293", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E1C0F63-4CF8-4DBE-8382-68AAF5BA2EEF", "versionEndExcluding": "5.4.292", "versionStartIncluding": "5.4.255", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6A39FE1-2EDE-4A5B-A6B8-1FF7FB12FCD7", "versionEndExcluding": "5.10.236", "versionStartIncluding": "5.10.193", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "954DCB85-1A70-4D6F-803D-F08554B92053", "versionEndExcluding": "5.15.180", "versionStartIncluding": "5.15.129", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "64F3AB12-D09C-4CC0-A1D0-80C64AE2F11C", "versionEndExcluding": "6.1.134", "versionStartIncluding": "6.1.50", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "043416BF-CC26-44F1-88BF-D9468ABD1929", "versionEndExcluding": "6.6.87", "versionStartIncluding": "6.4.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26CAB76D-F00F-43CE-BEAD-7097F8FB1D6C", "versionEndExcluding": "6.12.23", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7E864B0-8C00-4679-BA55-659B4C9C3AD3", "versionEndExcluding": "6.13.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0", "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free in print_graph_function_flags during tracer switching\n\nKairui reported a UAF issue in print_graph_function_flags() during\nftrace stress testing [1]. This issue can be reproduced if puting a\n'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(),\nand executing the following script:\n\n  $ echo function_graph > current_tracer\n  $ cat trace > /dev/null &\n  $ sleep 5  # Ensure the 'cat' reaches the 'mdelay(10)' point\n  $ echo timerlat > current_tracer\n\nThe root cause lies in the two calls to print_graph_function_flags\nwithin print_trace_line during each s_show():\n\n  * One through 'iter->trace->print_line()';\n  * Another through 'event->funcs->trace()', which is hidden in\n    print_trace_fmt() before print_trace_line returns.\n\nTracer switching only updates the former, while the latter continues\nto use the print_line function of the old tracer, which in the script\nabove is print_graph_function_flags.\n\nMoreover, when switching from the 'function_graph' tracer to the\n'timerlat' tracer, s_start only calls graph_trace_close of the\n'function_graph' tracer to free 'iter->private', but does not set\nit to NULL. This provides an opportunity for 'event->funcs->trace()'\nto use an invalid 'iter->private'.\n\nTo fix this issue, set 'iter->private' to NULL immediately after\nfreeing it in graph_trace_close(), ensuring that an invalid pointer\nis not passed to other tracers. Additionally, clean up the unnecessary\n'iter->private = NULL' during each 'cat trace' when using wakeup and\nirqsoff tracers.\n\n [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Fix use-after-free en print_graph_function_flags durante el cambio de tracer Kairui inform\u00f3 de un problema de UAF en print_graph_function_flags() durante las pruebas de estr\u00e9s de ftrace [1]. Este problema se puede reproducir si se pone un 'mdelay(10)' despu\u00e9s de 'mutex_unlock(&amp;trace_types_lock)' en s_start() y se ejecuta el siguiente script: $ echo function_graph &gt; current_tracer $ cat trace &gt; /dev/null &amp; $ sleep 5 # Asegurarse de que 'cat' alcance el punto 'mdelay(10)' $ echo timerlat &gt; current_tracer La causa ra\u00edz se encuentra en las dos llamadas a print_graph_function_flags dentro de print_trace_line durante cada s_show(): * Una a trav\u00e9s de 'iter-&gt;trace-&gt;print_line()'; * Otra funci\u00f3n mediante 'event-&gt;funcs-&gt;trace()', que est\u00e1 oculta en print_trace_fmt() antes del retorno de print_trace_line. Al cambiar de trazador, solo se actualiza el primero, mientras que el segundo contin\u00faa usando la funci\u00f3n print_line del trazador anterior, que en el script anterior es print_graph_function_flags. Adem\u00e1s, al cambiar del trazador 'function_graph' al trazador 'timerlat', s_start solo llama a graph_trace_close del trazador 'function_graph' para liberar 'iter-&gt;private', pero no lo establece en NULL. Esto permite que 'event-&gt;funcs-&gt;trace()' use un 'iter-&gt;private' no v\u00e1lido. Para solucionar este problema, establezca 'iter-&gt;private' en NULL inmediatamente despu\u00e9s de liberarlo en graph_trace_close(), lo que garantiza que no se pase un puntero no v\u00e1lido a otros trazadores. Adem\u00e1s, limpie el 'iter-&gt;private = NULL' innecesario durante cada 'cat trace' al usar los trazadores wakeup e irqsoff. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/"}], "id": "CVE-2025-22035", "lastModified": "2025-04-25T18:43:50.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-04-16T15:15:56.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 71EE7896-7ADF-4518-840E-AFA5008A220C (string)

versionEndExcluding : 4.15 (string)

versionStartIncluding : 4.14.324 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D51950EF-B814-4998-A0B2-65B014DDF4B1 (string)

versionEndExcluding : 4.20 (string)

versionStartIncluding : 4.19.293 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6E1C0F63-4CF8-4DBE-8382-68AAF5BA2EEF (string)

versionEndExcluding : 5.4.292 (string)

versionStartIncluding : 5.4.255 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C6A39FE1-2EDE-4A5B-A6B8-1FF7FB12FCD7 (string)

versionEndExcluding : 5.10.236 (string)

versionStartIncluding : 5.10.193 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 954DCB85-1A70-4D6F-803D-F08554B92053 (string)

versionEndExcluding : 5.15.180 (string)

versionStartIncluding : 5.15.129 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 64F3AB12-D09C-4CC0-A1D0-80C64AE2F11C (string)

versionEndExcluding : 6.1.134 (string)

versionStartIncluding : 6.1.50 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 043416BF-CC26-44F1-88BF-D9468ABD1929 (string)

versionEndExcluding : 6.6.87 (string)

versionStartIncluding : 6.4.13 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 26CAB76D-F00F-43CE-BEAD-7097F8FB1D6C (string)

versionEndExcluding : 6.12.23 (string)

versionStartIncluding : 6.7 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E7E864B0-8C00-4679-BA55-659B4C9C3AD3 (string)

versionEndExcluding : 6.13.11 (string)

versionStartIncluding : 6.13 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FADAE5D8-4808-442C-B218-77B2CE8780A0 (string)

versionEndExcluding : 6.14.2 (string)

versionStartIncluding : 6.14 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ (string)

}

1 : { »

lang : es (string)

value : En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: Fix use-after-free en print_graph_function_flags durante el cambio de tracer Kairui informó de un problema de UAF en print_graph_function_flags() durante las pruebas de estrés de ftrace [1]. Este problema se puede reproducir si se pone un 'mdelay(10)' después de 'mutex_unlock(&trace_types_lock)' en s_start() y se ejecuta el siguiente script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Asegurarse de que 'cat' alcance el punto 'mdelay(10)' $ echo timerlat > current_tracer La causa raíz se encuentra en las dos llamadas a print_graph_function_flags dentro de print_trace_line durante cada s_show(): * Una a través de 'iter->trace->print_line()'; * Otra función mediante 'event->funcs->trace()', que está oculta en print_trace_fmt() antes del retorno de print_trace_line. Al cambiar de trazador, solo se actualiza el primero, mientras que el segundo continúa usando la función print_line del trazador anterior, que en el script anterior es print_graph_function_flags. Además, al cambiar del trazador 'function_graph' al trazador 'timerlat', s_start solo llama a graph_trace_close del trazador 'function_graph' para liberar 'iter->private', pero no lo establece en NULL. Esto permite que 'event->funcs->trace()' use un 'iter->private' no válido. Para solucionar este problema, establezca 'iter->private' en NULL inmediatamente después de liberarlo en graph_trace_close(), lo que garantiza que no se pase un puntero no válido a otros trazadores. Además, limpie el 'iter->private = NULL' innecesario durante cada 'cat trace' al usar los trazadores wakeup e irqsoff. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ (string)

}

]

id : CVE-2025-22035 (string)

lastModified : 2025-04-25T18:43:50.147 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2025-04-16T15:15:56.110 (string)

references : [ »

0 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a (string)

}

1 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f (string)

}

2 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb (string)

}

3 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 (string)

}

4 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b (string)

}

5 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e (string)

}

6 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a (string)

}

7 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 (string)

}

8 : { »

source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

tags : [ »

0 : Patch (string)

]

url : https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 (string)

}

]

sourceIdentifier : 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-416 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "kernel: tracing: Fix use-after-free in print_graph_function_flags during tracer switching", "id": "2360210", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2360210"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntracing: Fix use-after-free in print_graph_function_flags during tracer switching\nKairui reported a UAF issue in print_graph_function_flags() during\nftrace stress testing [1]. This issue can be reproduced if puting a\n'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(),\nand executing the following script:\n$ echo function_graph > current_tracer\n$ cat trace > /dev/null &\n$ sleep 5  # Ensure the 'cat' reaches the 'mdelay(10)' point\n$ echo timerlat > current_tracer\nThe root cause lies in the two calls to print_graph_function_flags\nwithin print_trace_line during each s_show():\n* One through 'iter->trace->print_line()';\n* Another through 'event->funcs->trace()', which is hidden in\nprint_trace_fmt() before print_trace_line returns.\nTracer switching only updates the former, while the latter continues\nto use the print_line function of the old tracer, which in the script\nabove is print_graph_function_flags.\nMoreover, when switching from the 'function_graph' tracer to the\n'timerlat' tracer, s_start only calls graph_trace_close of the\n'function_graph' tracer to free 'iter->private', but does not set\nit to NULL. This provides an opportunity for 'event->funcs->trace()'\nto use an invalid 'iter->private'.\nTo fix this issue, set 'iter->private' to NULL immediately after\nfreeing it in graph_trace_close(), ensuring that an invalid pointer\nis not passed to other tracers. Additionally, clean up the unnecessary\n'iter->private = NULL' during each 'cat trace' when using wakeup and\nirqsoff tracers.\n[1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/"], "name": "CVE-2025-22035", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-22035\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22035\nhttps://lore.kernel.org/linux-cve-announce/2025041658-CVE-2025-22035-b50c@gregkh/T"], "threat_severity": "Moderate"}

{

bugzilla : { »

description : kernel: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (string)

id : 2360210 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2360210 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 5.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (string)

status : draft (string)

}

details : [ »

0 : In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ (string)

]

name : CVE-2025-22035 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Out of support scope (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

2 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Out of support scope (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

3 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

4 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

5 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : kernel (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

6 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : kernel-rt (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

]

public_date : 2025-04-16T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2025-22035 https://nvd.nist.gov/vuln/detail/CVE-2025-22035 https://lore.kernel.org/linux-cve-announce/2025041658-CVE-2025-22035-b50c@gregkh/T (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object